A critical Server-Side Request Forgery vulnerability in Red Hat AI Inference Server and RHEL AI allows attackers to bypass network restrictions and access internal services.

The vulnerability exists in the MediaConnector class, specifically within the load_from_url and load_from_url_async methods, which fail to properly validate user-provided URLs. An attacker with low-level privileges can exploit this to force the server to interact with arbitrary internal network resources.

Successful exploitation allows an attacker to interact with internal services that are otherwise protected by the network perimeter, potentially leading to unauthorized data exfiltration or internal service disruption. Given the CVSS score of 7.1, this represents a high-severity risk to infrastructure confidentiality and integrity. The ability to perform internal reconnaissance through the AI server may serve as a precursor to further lateral movement within the corporate network.

Immediate Action: Monitor official Red Hat security advisories and apply available patches for vLLM components as soon as they are released.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the AI inference environment, specifically targeting internal IP ranges or sensitive metadata services.

Compensating Controls: Implement strict egress filtering on the server hosting the AI inference engine to prevent unauthorized connections to internal network segments.

Public Exploit Available: False

Organizations utilizing Red Hat AI Inference Server or RHEL AI should prioritize this issue as a high-priority security item. Until official patches are applied, network-level segmentation remains the most effective defense against the potential misuse of this SSRF vulnerability. Ensure that the service account running the inference engine operates with the principle of least privilege regarding network access.